NarwhalRAT Xcopy USB Data Staging

Duo Tech@duotech

•updated Jun 17, 2026•0•0•5

Detects the specific xcopy command-line arguments used by APT37 NarwhalRAT to silently copy data from removable drives to a local temporary path. This rule looks for the combination of '/s', '/e', '/y', '/c', '/q', '/h', and '/b' flags used with xcopy.exe, which is indicative of the malware's data staging behavior.